voucher[.]echoreach[.]id

The domain voucher.echoreach.id was registered on February 26, 2026 and is currently taken offline. DNS resolution points to the IPv4 address 203.194.112.69, which is hosted in Indonesia under AS58487 (CV. Rumahweb Indonesia). The site presented the page title "Masuk | ECHO" before being seized, but no further content analysis is available.

Reputation data shows the domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, indicating a highly untrusted reputation. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, confirming at least one vendor flagged the domain as malicious. The SSL certificate associated with the host is identified only by the label "E8," without further validation details.

The combination of recent creation, low trust score, blocklist presence, and a positive detection suggests the domain was used for a generic phishing campaign targeting users who might be lured by the "Masuk | ECHO" login prompt. Because the site is offline, active exploitation cannot be confirmed, but the infrastructure remains reachable and could be reused. Defenders should continue to block the domain and the associated IP address at perimeter controls, monitor for any resurgence of the host, and incorporate the observed indicators—domain name, IP, SSL label, and blocklist entries—into threat‑intelligence feeds. Organizations should also advise users to avoid unsolicited login requests referencing "ECHO" and to verify legitimate URLs through trusted channels.